1. Home
2. EDPB and EDPS Joint Opinion on European Biotech Act

EDPB and EDPS Joint Opinion on European Biotech Act

12 March 2026

EDPB and EDPS support harmonisation of clinical trials under European Biotech Act, but call for specific safeguards for sensitive health data.

-

-

The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a Joint Opinion on the European Commission’s Proposal for a European Biotech Act. The Proposal aims to strengthen Europe’s biotechnology and biomanufacturing sectors, particularly in the area of health, by streamlining the regulatory framework and updating the rules for clinical trials.

The EDPB and the EDPS support the Proposal’s objective of fostering the EU’s competitiveness and addressing existing fragmentation in the application of the Clinical Trials Regulation (CTR). In particular, they welcome the aim to establish a single legal basis for the processing of personal data by sponsors and investigators, which will significantly improve legal clarity across Europe.

At the same time, the EDPB and the EDPS underline that the sensitivity of health and genetic data processed in the context of clinical trials requires a high standard of protection. The Joint Opinion provides several recommendations to ensure that the proposed simplifications do not lower the level of protection for clinical trial participants.

Key recommendations include:

• Clarifying controller roles: The Proposal should specify whether the actors involved in funding and conducting clinical trials act as sole or joint data controllers, to ensure a clear allocation of responsibilities.
• Limiting data retention: The mandatory 25-year minimum retention period should expressly apply only to the clinical trial master file, rather than to all personal data processed during a trial.
• Further processing for other clinical trials or for scientific research: As the Proposal aims to provide a legal basis under Union law for the further processing of trial data by the same controller, the Biotech Act should clearly define the purposes, as well as specific safeguards for such processing.
• Coherence with the AI Act: While promoting the use of AI in biotechnology, the Biotech Act should ensure that obligations for sponsors complement the existing requirements under the AI Act to ensure a consistent regulatory environment.
• Appropriate technical and organisational measures: The CTR should explicitly require the use of pseudonymisation whenever it is not necessary to process directly identifiable personal data.

• Regulatory sandboxes: If needed, the Commission's implementing acts regarding sandboxes in the specific context of clinical trials should provide for the legal basis for the processing of personal data, as well as for the derogation under Art. 9(2) for the processing of sensitive data; regarding other sandboxes, the processing of personal data should always be based on a legal basis under the GDPR.
  Texte reference

  Reference text

• Joint Opinion on the European Commission’s Proposal for a European Biotech Act - EDPB

• #EDPB

• #Health data

This can also interest you ...

EDPB adopts a report on its Coordinated Enforcement Framework (CEF) action on the right to be ... 18 February 2026 EDPB
Digital Omnibus: EDPB and EDPS support simplification and competitiveness while raising key concern 12 February 2026 EDPB
EDPB adopts its contribution to the evaluation of the Data Protection Law Enforcement Directive and ... 21 January 2026 EDPB